How personal data is handled when you visit the AppleTree APTESG website, submit an enquiry or communicate with the project.
Last updated: September 2026
Scope
This policy applies to the public website at www.appletreetoken.com and its website communication pathways.
This Privacy & Cookie Policy explains how personal data is handled when you visit www.appletreetoken.com, use its contact form or communicate by email about the website and the AppleTree APTESG project.
It describes the current website configuration and processing activities verified for this version of the site.
This policy does not cover the APTESG dApp, ESG Dashboard, wallet connections, blockchain activity or KYC processes.
Those interfaces and activities are separate from this website and will require their own privacy information before the relevant processing is offered.
Controller
Armando Dragoti is the data controller and current operator of this website in Italy. AppleTree APTESG is the public name of the project. It is not currently an incorporated company or a legally established foundation.
Data collected
The categories depend on how you use the website and what you choose to include in a communication.
The contact form requires you to confirm that you have read this policy. That acknowledgement is sent to the internal contact endpoint only to validate the submission. It is not forwarded to Resend and is not consent for general data processing or marketing.
The form also uses a non-visible field as a proportionate anti-spam measure. Information generated by that control is used only to identify automated or abusive submissions.
Purposes and legal bases
The relevant legal basis depends on the purpose and context of each request. Consent is not the general basis for submitting the contact form.
When you submit a pilot application or ask to establish a collaboration, relevant data may be processed to take steps at your request before a possible agreement.
Generic enquiries may be processed to respond and manage project communications. Technical information may be processed to operate, protect and diagnose the website, prevent abuse and maintain service security.
Data may be processed where necessary to handle privacy rights requests or comply with other applicable legal obligations.
Relevant information may be retained or used where necessary to establish, exercise or defend legal rights.
Google Analytics 4 is activated only after you give consent. You can change or withdraw that consent at any time through Cookie settings in the website footer, without affecting processing carried out before withdrawal.
Contact form and email
When you submit a valid form, your browser sends the information to the website endpoint at /api/contact. The endpoint validates the request and uses Resend to deliver the message to the AppleTree APTESG mailbox. Your email address is used as the reply-to address so the project can respond.
The application does not use an application database to store contact messages. Technical providers may process and retain data as part of delivering their respective services.
If online delivery is unavailable, the website may offer an email fallback. No fallback email is sent automatically: it is prepared only after you choose the link and is handled by your email application and providers if you decide to send it.
Name, email address, enquiry type, message and confirmation that you have read this policy are required. Company or organisation is required only for a Pilot application. Role is optional, and company or organisation is optional for other enquiry types.
The form cannot be submitted without the required information. Please do not send sensitive personal data, credentials, confidential information, ESG or KYC documents, or internal documents through this initial contact form.
Technical services
Netlify provides website hosting and server functions. To deliver, secure and diagnose the service, its infrastructure may process technical information such as IP address, requested URL, date and time, user agent, response status and technical request identifiers.
The exact availability and retention of infrastructure logs depend on the active service configuration. Technical information should be retained only for the configured period and for as long as reasonably needed for delivery, security, abuse prevention and diagnosis.
The token ticker on the APTESG page calls an internal website API. The server then requests public market information from CoinGecko / GeckoTerminal and, when necessary, DexScreener as a fallback.
Based on the current code, the visitor's IP address is not forwarded directly to those market-data providers. They receive technical information associated with the server-to-server request, including the server's network address, request time and requested market-data resource.
Recipients and providers
Access is limited to what is needed for each service or a legally justified purpose.
Website hosting, delivery and server functions, including the contact and token-ticker endpoints.
Delivery of valid contact-form messages from the website endpoint to the project mailbox.
Email hosting for project email addresses and related correspondence.
Server-to-server market-data requests used to provide the public token ticker.
Fallback server-to-server market-data source when the primary token-data request is unavailable.
Consent-based website measurement used to understand traffic and improve website content and operation.
Relevant data may be disclosed to professional advisers, courts, regulators or public authorities only where necessary, legally justified or required by law.
Some providers, including Google in connection with Google Analytics 4, may process data outside the European Economic Area. Where an international transfer occurs, it is handled under the mechanism made available and contractually stated by the relevant provider, such as an applicable adequacy decision or standard contractual clauses where relevant. This statement does not by itself establish that every transfer is compliant; the precise mechanism depends on the provider, destination and service configuration and should be reviewed professionally.
Retention and access
Contact messages and related correspondence are retained for up to 24 months from the last substantive interaction.
They may be retained for longer only where necessary for an active relationship, a legal obligation, or the establishment, exercise or defence of legal rights. At the end of the applicable period, the data is deleted unless one of those reasons for longer retention applies.
Hosting logs and other technical data are retained according to the period configured or made available by the relevant provider and only as reasonably necessary for service delivery, security and diagnosis.
Analytics cookie durations are listed in the Analytics and cookies section. The separate retention period for event data in the Google Analytics property must be verified in the Google Analytics account and is not stated here as a fixed period.
Privacy requests are retained for the time needed to handle them and for a subsequent justified period where necessary to document compliance or manage a dispute.
Ordinary internal access to contact messages and related correspondence is limited to Armando Dragoti.
Technical providers may process personal data only to the extent involved in providing their services and under the arrangements applicable to those services. Other recipients may receive information only where necessary and legally justified.
Your rights
Rights depend on the circumstances, legal basis and conditions set by applicable data-protection law.
To exercise a right or ask a privacy question, write to:
privacy@appletreetoken.comReasonable information may be requested where needed to confirm identity and protect personal data from unauthorised disclosure.
The main website does not make decisions based solely on automated processing, and does not carry out profiling, that produces legal effects or similarly significant effects concerning visitors or people who submit enquiries.
The website uses technical and organisational measures intended to reduce risks such as unauthorised access, misuse, loss or alteration. These include input validation, anti-spam controls and access limitations appropriate to the current service.
No online transmission or storage method can guarantee absolute security. The project does not claim a security certification or guarantee that every risk can be eliminated.
This policy may be updated to reflect changes to the website, providers, processing activities or applicable requirements.
The date of the current version is displayed at the top of this page. Material changes should be presented through an appropriate notice where required.
Privacy contact
Contact Armando Dragoti at privacy@appletreetoken.com for privacy questions or requests concerning website data.
